General

  • Target

    e8dff3335c2f1149f87da3d8e1388934e6a1d323d5d5a8cece767b6673033ade

  • Size

    413KB

  • Sample

    220420-c1cjfadghm

  • MD5

    121d8a842bf9f8389570c4a623968d94

  • SHA1

    25b7cacfd8f087b6a1a85d3d945d303286b8e277

  • SHA256

    e8dff3335c2f1149f87da3d8e1388934e6a1d323d5d5a8cece767b6673033ade

  • SHA512

    0344e44f17dded4776053d4ad78e68587f37eb9dc31cb482ee5505d29308a12c7022591f323c47db464c844c3956466ea38ab840767d8a31db2b708cf316b568

Malware Config

Extracted

Family

revengerat

Mutex

Targets

    • Target

      e8dff3335c2f1149f87da3d8e1388934e6a1d323d5d5a8cece767b6673033ade

    • Size

      413KB

    • MD5

      121d8a842bf9f8389570c4a623968d94

    • SHA1

      25b7cacfd8f087b6a1a85d3d945d303286b8e277

    • SHA256

      e8dff3335c2f1149f87da3d8e1388934e6a1d323d5d5a8cece767b6673033ade

    • SHA512

      0344e44f17dded4776053d4ad78e68587f37eb9dc31cb482ee5505d29308a12c7022591f323c47db464c844c3956466ea38ab840767d8a31db2b708cf316b568

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • RevengeRat Executable

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks